- [ ] Recent distro versions - [ ] sshd AllowEnv of `ansible_ssh_args` et al - [ ] install `setfacl` for unprivileged become - [ ] install runas? doas? - [ ] Idea: tarpit sshd (e.g. on port 23), for testing connection timeout - [ ] Idea: Restricted shell - [ ] Idea: Posix only login shell, e.g. [dash](https://en.wikipedia.org/wiki/Almquist_shell#Dash) - [ ] Idea: Non-posix login shell, e.g. [fish](https://fishshell.com/) - [ ] #1023